I do credit the comic with being consistent with its own security model-- but attackers having stolen a password database is extremely common (was then too)...

I do credit the comic with being consistent with its own security model-- but attackers having stolen a password database is extremely common (was then too)... and the stakes that users face has also involved in the time since the comic was written. E.g. I've seen people get burned using the comics advice for "brainwallets", which is equivalent to having a published unsalted hash. It's okay to have a confined security model, so long as you understand that's what you're doing. But users usually lack any real ability to gauge how likely password hashes are to leak just due to lack of information on how the sites operate. I think a better justification of the comic's original security level is that it's sufficient for protecting things where a compromise is only a nuisance, as is usually the case for 'random website'. But that isn't true for all password choices people make.